SB2026091121 - Multiple vulnerabilities in Red Hat build of Keycloak 26.4
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-3429)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to take over an account.
The vulnerability exists due to improper access control in the Keycloak Account REST API when performing sensitive MFA credential actions from a lower-security session. A remote user can delete a victim\'s registered MFA/OTP credential and register an attacker-controlled MFA device to take over an account.
Exploitation requires possession of the victim\'s password.
2) Improper access control (CVE-ID: CVE-2025-14083)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose backend schema and rules.
The vulnerability exists due to improper access control in the Keycloak Admin REST API when handling administrative API requests. A remote privileged user can access backend schema and rules to disclose backend schema and rules.
3) Authorization bypass through user-controlled key (CVE-ID: CVE-2025-14777)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify or delete authorization resources belonging to another client.
The vulnerability exists due to improper access control in the ResourceSetService and PermissionTicketService admin API endpoints when handling authorization resource management requests. A remote privileged user can supply a valid resource ID belonging to another client to modify or delete its resources.
Exploitation is limited to resources within the same realm.
4) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-1035)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass single-use refresh token enforcement.
The vulnerability exists due to a time-of-check time-of-use race condition in the TokenManager class during refresh token processing when strict refresh token rotation is enabled. A remote user can send concurrent refresh requests using the same refresh token to bypass single-use refresh token enforcement.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-1180)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform blind server-side request forgery.
The vulnerability exists due to improper handling of jwks_uri in Keycloak OIDC Dynamic Client Registration when processing dynamic client registration requests. A remote attacker can provide a jwks_uri value to perform blind server-side request forgery.
6) Incorrect authorization (CVE-ID: CVE-2026-3190)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose permission ticket information.
The vulnerability exists due to improper role enforcement in the UMA 2.0 Protection API when handling requests using a token issued for a resource server client. A remote user can enumerate permission tickets to disclose permission ticket information.
The token does not need the uma_protection role.
7) Improper privilege management (CVE-ID: CVE-2026-3121)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper privilege management in realm-level Admin Permissions when Admin Permissions are enabled at the realm level. A remote privileged user can use the manage-clients permission to escalate privileges.
8) Open redirect (CVE-ID: CVE-2026-3872)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper redirect URI validation in the OIDC authorization endpoint when processing redirect URIs containing a ..;/ path traversal sequence and using a wildcard allowed path. A remote user can control another path on the same web server and bypass the allowed redirect URI path to disclose sensitive information.
User interaction is required.
9) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-3911)
CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive user information.
The vulnerability exists due to improper access control in the UserResource component when accessing a specific administrative endpoint. A remote privileged user can retrieve user attributes configured to be hidden to disclose sensitive user information.
The user must have the view-users role.
10) Improper access control (CVE-ID: CVE-2025-14082)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive role metadata.
The vulnerability exists due to improper access control in the Keycloak Admin REST API /admin/realms/{realm}/roles endpoint when handling requests to retrieve role metadata. A remote privileged user can send a request to the endpoint to disclose sensitive role metadata.
11) Incorrect authorization (CVE-ID: CVE-2026-2366)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose user organization membership information.
The vulnerability exists due to incorrect authorization in the organizations feature when handling organization membership queries. A remote user can use an unprivileged token to enumerate user organization memberships to disclose user organization membership information.
12) Improper isolation or compartmentalization (CVE-ID: CVE-2026-4325)
CWE-ID: CWE-653 - Improper isolation or compartmentalization
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to accounts.
The vulnerability exists due to improper type and namespace isolation in the SingleUseObjectProvider when handling single-use entries. A remote attacker can delete arbitrary single-use entries to replay consumed action tokens.
User interaction is required.
13) Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CVE-ID: CVE-2026-4636)
CWE-ID: CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized permissions to victim-owned resources.
The vulnerability exists due to authorization before parsing and canonicalization in Keycloak User-Managed Access policy validation when creating a policy with resource identifiers owned by other users. A remote user can include victim-owned resource identifiers in a policy creation request for an attacker-owned resource to gain unauthorized permissions to victim-owned resources.
The user must have the uma_protection role. Successful exploitation can enable acquisition of a Requesting Party Token.
14) Improper isolation or compartmentalization (CVE-ID: CVE-2026-4282)
CWE-ID: CWE-653 - Improper isolation or compartmentalization
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper isolation or compartmentalization in the SingleUseObjectProvider global key-value store when handling authorization codes. A remote attacker can forge authorization codes to escalate privileges.
Successful exploitation can result in the creation of admin-capable access tokens.
15) Excessive Platform Resource Consumption within a Loop (CVE-ID: CVE-2026-4634)
CWE-ID: CWE-1050 - Excessive Platform Resource Consumption within a Loop
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to excessive platform resource consumption within a loop in the OpenID Connect token endpoint when processing a specially crafted POST request with an excessively long scope parameter. A remote attacker can send a specially crafted POST request with an excessively long scope parameter to cause a denial of service.
Remediation
Install update from vendor's website.